Skip to content

fix: enable TypeScript tree-sitter parsing - #14

Open
floze-the-genius wants to merge 2 commits into
HeadyZhang:masterfrom
floze-the-genius:fix/typescript-tree-sitter-accessor
Open

fix: enable TypeScript tree-sitter parsing#14
floze-the-genius wants to merge 2 commits into
HeadyZhang:masterfrom
floze-the-genius:fix/typescript-tree-sitter-accessor

Conversation

@floze-the-genius

@floze-the-genius floze-the-genius commented Jul 19, 2026

Copy link
Copy Markdown

Summary

  • recognize tree_sitter_typescript.language_typescript() and convert its capsule to a tree_sitter.Language
  • move the optional core dependency to the compatible tree-sitter 0.24.x line
  • warn when an unknown accessor or initialization failure forces regex fallback
  • preserve the regex path's existing new Function() and imported exec / spawn detections when the TypeScript AST path is active

Root cause

tree_sitter_typescript 0.23.x exposes language_typescript() rather than LANGUAGE or language(). It returns a PyCapsule, which also requires tree-sitter 0.24.x for Language(capsule) conversion; the previous tree-sitter ^0.22.0 constraint could not initialize that grammar.

Testing

  • 1516 passed, 1 skipped with all tree-sitter grammar packages installed
  • ruff check packages/audit
  • ruff check tests/test_parsers/test_treesitter_parser.py tests/test_typescript_scanner.py
  • mypy packages/audit/agent_audit --ignore-missing-imports (81 source files)
  • package-extra smoke test installed agent-audit[tree-sitter], resolved tree-sitter 0.24.0 / tree-sitter-typescript 0.23.2, and asserted TreeSitterParser(..., file_path="x.ts").is_tree_sitter_available

Scope

.tsx remains mapped to the TypeScript grammar, matching the current language mapping and the issue's requested minimal scope. Selecting the separate TSX grammar remains a follow-up design decision.

Closes #12.

AI assistance

This contribution was implemented and tested with OpenAI Codex assistance. The final diff and verification results were reviewed before submission.

Summary by CodeRabbit

  • Bug Fixes
    • Improved TypeScript/JavaScript detection for shell execution when exec*/spawn* are used without child_process. qualification, plus better handling of new Function().
    • Added clearer warnings when TypeScript tree-sitter initialization falls back to regex parsing.
    • Enhanced compatibility with TypeScript tree-sitter language accessor variations.
  • Documentation
    • Updated the changelog with an [Unreleased] → Fixed entry describing the TypeScript scanning behavior improvements.
  • Tests
    • Expanded tree-sitter parser tests to cover TypeScript language accessor handling, UTF-8 parsing input, and warning/fallback scenarios.

@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 01860928-de9b-404e-8910-e67f2d350101

📥 Commits

Reviewing files that changed from the base of the PR and between 28b5e7d and 3e86801.

📒 Files selected for processing (2)
  • packages/audit/agent_audit/parsers/treesitter_parser.py
  • tests/test_parsers/test_treesitter_parser.py
🚧 Files skipped from review as they are similar to previous changes (2)
  • tests/test_parsers/test_treesitter_parser.py
  • packages/audit/agent_audit/parsers/treesitter_parser.py

📝 Walkthrough

Walkthrough

The TypeScript tree-sitter path now recognizes the TypeScript language accessor, wraps compatible language objects, warns on initialization fallback, handles new calls, and detects unqualified shell-execution functions. Tests and the tree-sitter dependency constraint were updated accordingly.

Changes

TypeScript tree-sitter support

Layer / File(s) Summary
TypeScript parser initialization and fallback handling
packages/audit/agent_audit/parsers/treesitter_parser.py, packages/audit/pyproject.toml, tests/test_parsers/test_treesitter_parser.py, CHANGELOG.md
TypeScript language accessors and wrapped language objects are supported, initialization failures now warn and disable tree-sitter, the dependency constraint targets 0.24, and parser tests cover successful and fallback paths.
JavaScript and TypeScript dangerous-call detection
packages/audit/agent_audit/parsers/treesitter_parser.py, packages/audit/agent_audit/scanners/typescript_scanner.py
new_expression nodes use their constructor field, and unqualified exec, execSync, spawn, and spawnSync calls map to the existing shell-execution rule.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TypeScriptScanner
  participant TreeSitterParser
  participant TreeSitter
  TypeScriptScanner->>TreeSitterParser: initialize TypeScript parsing
  TreeSitterParser->>TreeSitter: resolve language and parse source
  TreeSitter-->>TreeSitterParser: return AST or initialization error
  TreeSitterParser-->>TypeScriptScanner: traverse calls or use regex fallback
  TypeScriptScanner-->>TypeScriptScanner: map exec/spawn calls to AGENT-034
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely summarizes the main change: enabling TypeScript tree-sitter parsing.
Linked Issues check ✅ Passed The PR satisfies #12 by handling the TypeScript accessor, warning on fallback, and preserving existing detection behavior.
Out of Scope Changes check ✅ Passed The changes stay focused on TypeScript tree-sitter parsing, fallback handling, and related tests, docs, and dependency updates.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/audit/agent_audit/parsers/treesitter_parser.py`:
- Around line 190-219: Update the tree-sitter initialization logic to remove the
wrap_language flag and unconditionally convert lang to a tree_sitter.Language
when it is not already that type, before constructing tree_sitter.Parser in the
parser setup flow. Preserve all language accessor branches and fallback behavior
unchanged.

In `@packages/audit/agent_audit/scanners/typescript_scanner.py`:
- Around line 66-69: Update the AGENT-034 handling associated with the
ts_child_process_exec mappings in the TypeScript scanner to support all required
pattern types: tool_no_input_validation, eval_exec_expanded, and
subprocess_expanded. Ensure the relevant handling logic recognizes and processes
each pattern type, not just the existing mapping definitions.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 92be8679-87c1-49c2-a6dd-9ecc9999627f

📥 Commits

Reviewing files that changed from the base of the PR and between 1009782 and 28b5e7d.

📒 Files selected for processing (5)
  • CHANGELOG.md
  • packages/audit/agent_audit/parsers/treesitter_parser.py
  • packages/audit/agent_audit/scanners/typescript_scanner.py
  • packages/audit/pyproject.toml
  • tests/test_parsers/test_treesitter_parser.py

Comment thread packages/audit/agent_audit/parsers/treesitter_parser.py
Comment thread packages/audit/agent_audit/scanners/typescript_scanner.py
Signed-off-by: Floze <88098863+floze-the-genius@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

typescript_scanner: TS AST path silently disabled due to stale tree_sitter_typescript language-module API

1 participant